DevSecOps Was Bolted On, Not Built In

▶ Watch (2:41)

DevOps worked because the business liked it. Faster releases meant more money. DevSecOps was bolted onto that foundation without the same pull. The noble cause was delivering software at DevOps speed while keeping it secure. The problem: developers didn’t believe there was a security problem to fix. Security findings don’t behave like QA defects, which reproduce predictably. Worcel described a bug requiring 20 steps to reproduce: developers ignore it because their users won’t bother either. Security vulnerabilities get the same treatment.

Building a Security Movement from Early Adopters

▶ Watch (8:55)

Lehr’s AppSec strategy builds on relationships before touching tools. The diffusion of innovation curve shows why: innovators and early adopters make up a small fraction of any population, laggards resist longest. The goal is to win over early adopters and let them carry the message to peers. Peers influence other developers more than the security team does. A NIST study from the 1990s gives the financial argument: fixing a bug in production costs far more than catching it early in the cycle.

How the Pipeline Got Buried Under Scanning Tools

▶ Watch (19:25)

Security teams added tools at every stage. IDE plugins developers ignored. SAST, SCA, and secret scanning on builds. DAST, IAST, and API testing on test environments. Security gates blocked production deploys until findings were fixed. Those gates turned into SLAs developers asked for exceptions on, with due dates set for 2030. Pen testing and bug bounties added more accurate findings to a backlog nobody was clearing. Each layer compounded the noise without improving whether developers actually fixed anything. Adding new tools to an adoption problem doesn’t solve the adoption problem.

ADR, ASM, and Automatic Remediation Target the Backlog

▶ Watch (22:00)

ADR (Application Detection Response) automates triage rather than waiting for someone to respond to logged events. ASM tools with reachability and exploitability analysis cut the noise: instead of reviewing every finding, teams focus on vulnerabilities that are both reachable and exploitable. Automatic remediation generates code fixes for findings, clearing a large share of the low-hanging fruit fast. Worcel drew a hard line: generating a fix is not fixing the code. Until a developer reviews and merges the pull request, the product is no more secure than it was.

Security Champions Need Recognition, Not Just Titles

▶ Watch (24:50)

Calling someone a Security Champion and adding it as a side task doesn’t work. Worcel: if champions fix findings and nobody acknowledges that work, they stop. Lehr’s SAPS framework maps four reward types: status (public recognition like “vulnerability fixer of the month”), access (breach data for trusted champions), power (skipping certain security team approvals), and stuff (traditional rewards). Status and access outperform swag. Champions who reach high levels can bypass certain approval steps, giving their whole team faster movement through the pipeline.

Q&A

What recognition or rewarding techniques have been most impactful? Lehr cited SAPS: status rewards like naming and announcing a “vulnerability fixer of the month” beat swag, and access rewards like visibility into company breach data for trusted champions drive sustained engagement. ▶ Watch (28:29)

How do automation tools connect to the relationship-building side? Worcel: automatic remediation generates a fix but the product isn’t more secure until a developer reviews and merges it. Tools surface findings; relationships and recognition determine whether anyone acts on them. ▶ Watch (35:20)

Notable Quotes

there is a problem they don’t believe Worcel · ▶ Watch (5:40)

but people are more willing to listen to Lehr · ▶ Watch (15:28)

like I said automation won’t save you Lehr · ▶ Watch (36:25)

to GitHub is the product more secure no Worcel · ▶ Watch (36:53)

Key Takeaways

  • DevSecOps failed because developers didn’t believe there was a problem, not because tools were missing.
  • Early adopters on dev teams carry more influence with peers than the security team does.
  • SAPS rewards (status, access, power, stuff) motivate security champions better than titles or swag.

About the Speaker(s)

Eitan Worcel is the co-founder and CEO of Mobb, the Black Hat StartUp Spotlight winner. He has over 15 years of experience in application security as a developer, product management leader, and business leader.

Dustin Lehr is Director of Application Advocacy at Security Journey and co-founder of Katilyst. A former software engineer and cybersecurity leader, he builds developer-centric AppSec programs that motivate security-minded behaviors.